PRACTICAL FIELD GUIDE
What local logout does and does not do
Local logout removes a session from the current client, but it is not the same as server-side token revocation. Make the distinction visible in your architecture and tests.
MCPBackend editorial team · · Examples are illustrative
Put it into practice
- Remove the stored token and clear user-specific cached data when signing out.
- Verify subsequent requests from that client no longer send the credential.
- Document the backend's current revocation limitations and any additional session controls your product requires.
What this looks like
ILLUSTRATIVE EXAMPLE
The app clears local storage and returns to login. That ends this client's normal use of the token but does not erase a copy stored elsewhere.
A boundary to keep clear
Do not describe local logout as invalidating every existing token across devices.
MCPBackend context
Application email/password authentication is separate from the developer dashboard login and MCP OAuth connection. The current app-user tokens are project-scoped and do not automatically expire. Do not assume built-in refresh, password reset, per-token revocation or social login; check supported behavior before designing those flows.
Take the next step
Inspect the current project contract, try the change with disposable data, and verify the result through the same credentials your app will use. Record the expected response and one denied-access case before release.
Sources and further reading
These references explain the underlying protocols and design principles. For supported MCPBackend operations and exact request shapes, inspect your project’s generated API contract.